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Frost & Sullivan’s Global Research Platform 


Frost & Sullivan is in its 50th year of business with a global research organization of 1,800 
analysts and consultants who monitor more than 300 industries and 250,000 companies. 
The company’s research philosophy originates with the CEO’s 360-Degree Perspective™, 
which serves as the foundation of its TEAM Research™ methodology. This unique approach 
enables us to determine how best-in-class companies worldwide manage growth, 
innovation and leadership. Based on the findings of this Best Practices research, Frost & 
Sullivan is proud to present the 2013 Global Market Leadership Award in Vulnerability 
Management to Qualys. 


Significance of the Market Leadership Award 


Key Industry Challenges 


In 2013, the nature of malicious attacks started changing. Compared to 2011 and 2012, 
attacks have become highly-directed (involving less phishing) and are now also targeted 
at smaller businesses. As the intent of attackers has changed and expanded, product 
evolution must also change. Correspondingly, the market reality for vendors in the 
security field is that the greatest opportunities for growth will be to augment legacy 
products/platforms designed for larger enterprises to accommodate small and midsized 
businesses. 


Not only is the attack environment changing, the network that is being protected is 
undergoing changes. In the Internet of Everything, literally all new devices on networks 
have Internet Protocol (IP) addresses, which link them to cloud services. Companies 
increasingly permit remote employees to bring their own phone or PC onto the company’s 
infrastructure (BYOD). Lastly, the advent of virtualization in hardware, software, devices, 
and operating systems add to the challenges of conducting vulnerability assessments at 
the speed and comprehensiveness required. 


Importantly, vulnerability management (VM) platforms are moving away from being a 
standalone, uni-functional product or service. The attitude of VM providers is that, in 
addition to checking for formal vulnerabilities for networks and web applications, they can 
deliver value-added services by checking configurations, validating the status of SSL 
certificates, and detecting malware while they are “under the hood,” as a manner of 
speaking. 


Lastly, vulnerability management has to become more versatile. At its genesis, 
vulnerability management systems were ported onto servers as software or as an 
appliance. This methodology is not outmoded; in many market verticals such as 
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healthcare, it is preferred that data stays on the premises. Additionally, in many countries, 
there are laws that mandate that data must stay on-premises. However, to facilitate small 
and midsized businesses with limited IT resources, some forms of vulnerability 
management need to emanate remotely. Smart vulnerability management providers are 
delivering their capabilities through the Software-as-a-Service (SaaS) model that can now, 
thanks to virtualization, also be delivered “on premise” and building partnerships with 
Managed Security Service Providers (MSSPs) to provide their customers several options to 
improve their security postures. 


Best Practice Award Analysis for Qualys 


The Frost & Sullivan Award for Market Leadership is presented to the company that has 
demonstrated excellence in capturing the highest market share within its industry while 
demonstrating its capacity for innovation. The Award recognizes the company's leadership 
position within the industry in terms of revenues or units, as specified. 


Qualys’ Performance in Vulnerability Management 


In 2013, the vulnerability management market reached $528.6 million globally following 
growth of 15 percent from 2012. Qualys is growing faster than the overall market. Its year- 
over-year growth rate for each of the past three quarters ranged between 17% and 18%. 
For 2013, Frost & Sullivan estimates Qualys’ market leading share to be 18 percent. 


Key Performance Drivers for Qualys 


As the market share leader and first-mover in vulnerability management, it would be 
relatively easy for Qualys to be satisfied with its products and legacy relationships. Indeed, 
Qualys enjoys advantages in the sense that security teams are familiar with its solutions. 
This reason notwithstanding, a primary reason that Qualys holds its market share 
advantage is that the company is adapting its current products to face new market needs 
and challenges. Qualys is also expanding its capabilities operationally to create new 
protections and value-added services. 


Qualys has taken a sizable market share with large enterprises, including more than 40% of 
the Fortune 500. The company is now making a concerted effort to win customers in the 
small to medium sized market segments. For example, QualysGuard Express Lite, which 
was introduced in the summer of 2013 is designed for vulnerability and application scanning 
for businesses with 250 IP addresses or less. The relationships that Qualys has established 
with Managed Security Services Providers (MSSPs), like Verizon and Dell SecureWorks, 
which already cover enterprises, are increasingly being used to reach midsized businesses. 
Also, in May 2013, Qualys announced a partnership program with Porficio to offer Cloud-IT 
and compliance reporting, also aimed at midsized businesses. 


Accounting for what is going on in the network is just as essential as fortifying the defensive 
posture against attacks. At minimum, a vulnerability management system should account 
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for all of the devices on the network. Unknown and unmanaged connected devices, as in 
Bring Your Own Device (BYOD), and shared devices, as in healthcare settings, add to the 
challenges of knowing and understanding the risks each network-connected device poses. 
To address these challenges, QualysGuard not only “fingerprints” devices, the technology 
also catalogs where the device is mapped to, the operating system it is running, and scores 
the device for vulnerability. 


Like advancements in information technologies, the philosophy behind vulnerability 
scanning is advancing as well. The scanning process was once an onerous and mechanical 
process. A full system scan would be performed on, for example, a Sunday. Vulnerabilities 
would be uncovered and patched two days later on Tuesday. A similar full system scan 
would then be initiated and the patch and remediation cycle would begin anew. This process 
can and should be streamlined. With Qualys, the initial scan detects vulnerabilities and 
provides patching and remediation information and prioritization. Applying analytics, the 
next set of scans start from the list of vulnerabilities uncovered in previous scans rather 
than starting from “ground zero.” In this manner, scans can be conducted with greater 
frequency. 


Also noteworthy, Qualys has developed relationships with password managers such as 
Cyber-Ark, Thycotic, and Lieberman Software for password management during 
authenticated scanning. When Qualys executes a vulnerability scan, the scan will also 
determine which SSL certificates are valid, expired, or are self-authenticated. Entry through 
networks by using invalid or made up SSL certificates is another way for attackers to exploit 
a network. 


Because vulnerability management is at the core of providing a company’s security and 
compliance posture, it has the potential of expanding well beyond a best of breed point 
solution by providing an open platform that can further help customers fight cyber threats. 
That’s why Qualys is capitalizing on its unique Cloud platform capabilities to provide new 
products in adjacent technologies and to deliver a powerful suite of open APIs. For example, 
Qualys now offers a Web Application Scanning solution, QualysGuard WAS, and has 
currently under beta a Web Application Firewall (WAF) solution. Also, Qualys is expanding 
its policy compliance offering with a cloud-based customizable questionnaire service helping 
enterprises automate manual compliance audits and articulate what they need from sub- 
contractors in terms of security and compliance. Finally, Qualys also offers malware 
detection as a part of its WAS solution and has multiple new services in the making (web log 
analysis, Cloud agent for end point protection and Continuous Perimeter Monitoring services 
that will be delivered in 2014). 


Qualys has also uniquely packaged its Cloud Platform to be delivered as a private cloud 
offering, thus broadening its market reach by addressing the market segments that still 
require an on-premise solution. This approach is unique in the sense that it preserves all of 
the advantages of a cloud offering while ensuring that the data never leaves the premises or 
the geography. 
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Qualys offers its cloud-based services to global customers via security operations centers 
(SOCs) that are located at various worldwide locations. For customers, such as MSSPs, 
enterprises and government agencies, that require these solutions as on-premise 
deployments, Qualys offers the QualysGuard Private Cloud Platform available as a fully 
virtualized QualysGuard software stack on VCE Vblock systems. 


The QualysGuard Cloud Platform (shared or private) is inherently highly extensible and 
scalable. It currently performs over 1 billion IP scans annually and detects and analyzes 
over 50 billion security events monthly. 


Ultimately, vulnerability management solutions must become as dynamic as the threat 
environment that they are designed to protect against. Qualys maintains its Market 
Leadership because of its strong technology cloud platform, ability to scale and ease-of-use 
and -deployment. Also, the company has successfully shown that it can rapidly innovate and 
deliver new capabilities suitable for customers of all sizes across vertical industries. This 
adaptability has allowed Qualys to consistently stay ahead in the innovation curve. 


Conclusion 


Qualys operates in a highly-competitive field of enterprise software security solutions that 
is rapidly consolidating. Frost & Sullivan estimates that roughly 21 companies generate 
revenues of $5 million or more annually in vulnerability management products. Vendors 
differentiate by the efficiency of their scan products, the integration of analytics, the 
ability to deliver products over several platforms, as well as the ability to address security 
by company size, industry vertical, and pricing. 


The principal reason that Qualys has been able to maintain its Market Leadership and has 
the potential to drastically increase it is that Qualys recognizes all of the elements in 
vulnerability management are essential and it has adapted its technology platforms 
accordingly. In addition, Qualys recognizes that its customers’ security needs are not 
limited to vulnerability management. By expanding its security solutions into 
complementary, adjacent security domains, Qualys has further strengthened its 
competitive position in the vulnerability management market. 


Critical Importance of TEAM Research 


Frost & Sullivan’s TEAM Research methodology represents the analytical rigor of our 
research process. It offers a 360-degree view of industry challenges, trends, and issues by 
integrating all seven of Frost & Sullivan's research methodologies. Our experience has 
shown over the years that companies too often make important growth decisions based on 
a narrow understanding of their environment, leading to errors of both omission and 
commission. Frost & Sullivan contends that successful growth strategies are founded on a 
thorough understanding of market, technical, economic, financial, customer, best 
practices, and demographic analyses. In that vein, the letters T, E, A and M reflect our 
core technical, economic, applied (financial and best practices) and market analyses. The 
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integration of these research disciplines into the TEAM Research methodology provides an 
evaluation platform for benchmarking industry players and for creating high-potential 
growth strategies for our clients. 


Chart 1: Benchmarking Performance with TEAM Research 
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About Frost & Sullivan 


Frost & Sullivan, the Growth Partnership Company, enables clients to accelerate growth 
and achieve best-in-class positions in growth, innovation and leadership. The company's 
Growth Partnership Service provides the CEO and the CEO's Growth Team with disciplined 
research and best-practice models to drive the generation, evaluation and implementation 
of powerful growth strategies. Frost & Sullivan leverages 50 years of experience in 
partnering with Global 1000 companies, emerging businesses and the investment 
community from more than 40 offices on six continents. To join our Growth Partnership, 
please visit http://www.frost.com. 
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